Perl Script To Decode Files From Quarantine Folder

[mkucharski]

Written by me, releasing under Public Domain.

 

$ perl dequarantine.pl qrt01cb7a7b5783e3d8.001
$ ls -l qrt01cb7a7b5783e3d8.001*
-rw-r--r--  1 mkucharski  mkucharski  166912 Nov 13  2008 qrt01cb7a7b5783e3d8.001
-rw-r--r--  1 mkucharski  mkucharski  166912 Jun 11 17:59 qrt01cb7a7b5783e3d8.001.dec

 

#!/usr/bin/perl
# Public Domain

use strict;
use warnings;

# function takes numeric representation of ASCII character and negates
# only those bits which are set to 1 on the same position in $magic
# pattern, leaving other bits in ASCII character unchanged
sub dequarantine($)
{
       # ascii number
       my $char = shift;

       # magic pattern
       my $magic = 0x77;

       # get set of bits which we need to negate
       my $s1 = $char & $magic;

       # get opposite set of bits which stay the same
       my $s2 = $char & ((~$magic) & 0xff);

       # negate first set of bits, but drop (zero)
       # bits which are not set in $magic pattern
       my $s3 = ((~$s1) & 0xff) & $magic;

       # combine bits which we shouldn't change ($s2) with
       # negated bits from $s3
       return ($s2 | $s3) & 0xff;
}

# open a file and modify bitwise all bytes in that file saving the output
# to original filename appended with '.dec' suffix
foreach my $file (@ARGV) {
       open(my $enc, '<', $file) || die $!;
       open(my $dec, '>', $file.'.dec') || die $!;

       while(my $n = read($enc, my $data, 1024) > 0) {
               foreach (unpack('C*', $data)) {
                       printf $dec "%c", dequarantine($_);
               }
       }

       close($dec) || warn $!;
       close($enc) || warn $!;
}